Secrets Management

Definition

A centralized cloud service used to securely store, rotate, manage, and retrieve highly sensitive credentials (like database passwords, API keys, and OAuth tokens) programmatically.

Explain Like I'm New

A digital lockbox. Instead of writing the database password in your code, your code asks the lockbox for the password right when it needs it.

Real World Example

AWS Secrets Manager, Azure Key Vault, GCP Secret Manager. A company mandates that all database passwords must be changed every 30 days. AWS Secrets Manager automatically logs into the database, changes the password, saves the new one, and the application never goes offline because it just asks Secrets Manager for the latest password dynamically.

Common Use Cases

•Credential protection
•Automated password rotation

Interview Questions

basic

Is it ever acceptable to hardcode a database password into your application's source code?

intermediate

How does a Secrets Manager differ from simply using Environment Variables?

Flash Cards

Question

Hardcode password?

Click to reveal answer

Answer

Absolutely not. Source code is often shared, pushed to GitHub, or leaked. Secrets must be externalized.

Question

Secrets Manager vs Env Vars?

Click to reveal answer

Answer

Environment variables are static and visible to anyone with access to the server. A Secrets Manager stores the secret centrally, encrypts it at rest, tracks exactly who accessed it in an audit log, and can automatically rotate it.